Built to be trusted with your keys.
Automations are only useful if you can trust the platform running them. Bearflow is designed so that the most sensitive things, your credentials and our control systems, are the hardest to reach. We use the most secure methods available to us at each layer, and we keep improving them.
Your credentials are locked away
Keys, tokens and passwords you give us are encrypted before they are stored, used only by the automation they belong to, and never shown again, not even to you. Deleting an automation deletes its credentials with it.
The control plane is never public
The systems that run your automations are not reachable from the internet. The website talks to them through a single narrow gateway where every request is cryptographically signed, expires within a minute and cannot be replayed.
No customer code, ever
Automations are assembled by our engineers from a fixed set of vetted building blocks. Customers fill in details; they cannot upload scripts or run commands on our systems, which removes the largest class of platform attacks.
Private networks are off limits
Every address an automation contacts must be a public https address. We check it when you create the automation and the engine checks again every time it runs, so an automation cannot be pointed at internal systems.
Accounts are defended
Sign-up and sign-in sit behind Cloudflare bot protection and strict rate limits. Passwords are stored as salted one-way hashes, sessions use secure, HTTP-only cookies, and state-changing requests are checked against cross-site forgery.
We keep as little as possible
Run history is deleted automatically after seven days. We never see card details: payments are handled by our licensed payment partner, Cashfree.
What we ask of you
- Use a unique password for your Bearflow account.
- Give automations the least access possible: a dedicated Telegram bot, a Discord webhook for one channel, or an app-specific email password rather than your main one.
- Revoke or rotate a key at its source if you ever think it has been exposed, then delete the automation that used it.
- Treat the private web address of a webhook automation like a password. Anyone who has it can post to it.
Be honest about limits
No system is perfectly secure, and we do not claim otherwise. What we commit to is reasonable, current, defence-in-depth security, prompt action when something goes wrong, and telling you plainly when it matters. The full commitments and their limits are set out in the Terms of Service.
Report a vulnerability
If you believe you have found a security issue, email [email protected] with the subject “Bearflow security”. Please give us reasonable time to fix it before disclosing it, and do not access other customers’ data or disrupt the service while testing. We will acknowledge good-faith reports promptly.